Cyber Threat Intelligence

What you will be able to do

• Write intelligence requirements tied to decisions someone actually makes
• Build a collection plan across internal telemetry and external sources
• Grade source reliability and information credibility consistently
• Apply analysis of competing hypotheses to a real ambiguous case
• Track adversary behaviour with MITRE ATT&CK rather than indicator lists
• State attribution claims at a level the evidence supports
• Convert reporting into detections, hunts and priorities
• Brief an executive audience using estimative language correctly

What you need before you start

• General security knowledge and familiarity with common attack patterns
• Confident written English, since much of the work is writing
• No programming required, though basic scripting helps with collection
• Time each week to complete analytic exercises before class

Who this course is for

• Analysts starting or running a threat intelligence function
• SOC and hunting staff who consume intelligence and want better inputs
• Incident responders who produce intelligence as a by-product of casework
• Risk and security managers who commission intelligence reporting
• Consultants writing threat assessments for clients

Questions about this course